| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: http://search.fbdownloader.com/?channel=deg_ntWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
09.04.2014, 20:07
| #1 |
| |  http://search.fbdownloader.com/?channel=deg_nt Hallo, wenn ich ein neues Fenster bei Firefox öffne bekomme ich immer diese Seite geöffnet: hxxp://search.fbdownloader.com/?channel=deg_nt ich habe schon den Malwarebytes Anti-Malware installiert und die Suche wie beschrieben durchgeführt und auch AdwCleaner und SecurityCheck und bin allen Anletungen gefolgt, leider keine Besserung nach neustart, was kann ich tun? |
|
10.04.2014, 06:04
| #2 |
| /// the machine /// TB-Ausbilder    | http://search.fbdownloader.com/?channel=deg_nt hi,
__________________Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
|
10.04.2014, 18:54
| #3 | ||
| | http://search.fbdownloader.com/?channel=deg_ntZitat:
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 13-03-2014 01
Ran by petb at 2014-04-10 19:39:13
Running from C:\Users\petb\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Microsoft Security Essentials (Enabled - Up to date) {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Microsoft Security Essentials (Enabled - Up to date) {2C040BB5-2B06-7275-5A21-2B969A740B4B}
==================== Installed Programs ======================
123 Free Solitaire v10.0 (HKLM\...\123 Free Solitaire_is1) (Version: - TreeCardGames)
Adobe Flash Player 11 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 11.5.502.146 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Reader X (10.1.9) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.9 - Adobe Systems Incorporated)
AIACalc (HKLM\...\AIACalc_is1) (Version: - LU-VE Sweden AB)
ALMEMO Control 5.18 (HKLM\...\AHLBRNGMBH-82171A40-7F7D-11D6-B4E9-0050BADB7784-08102007X2-5-18) (Version: - Ahlborn Mess- und Regelungstechnik GmbH. D803607 Holzkirchen)
AMR Control v5 (HKLM\...\AMRGMBH-82171A40-7F7D-11D6-B4E9-0050BADB7784) (Version: - Ahlborn Mess und Regelungstechnik GmbH. D803607 Holzkirchen)
AVS Media Player 4.2.2.104 (HKLM\...\AVS Media Player_is1) (Version: 4.2.2.104 - Online Media Technologies Ltd.)
AVS Video Converter 8 (HKLM\...\AVS4YOU Video Converter 7_is1) (Version: 8.4.2.541 - Online Media Technologies Ltd.)
Biet-O-Matic v2.14.10 (HKLM\...\Biet-O-Matic v2.14.10) (Version: 2.14.10 - BOM Development Team)
BisonCam (HKLM\...\{5BBC4803-C96E-4D3E-9D1D-2E43774C4062}) (Version: 9.2.1.71.34 - BisonCam)
ChiconyCam (HKLM\...\{A2201542-DA80-457F-8BD9-6C9C90196481}) (Version: 1.0.43.1129 - Chicony Electronics Co.,Ltd.)
Chinese Simplified Fonts Support For Adobe Reader X (HKLM\...\{AC76BA86-7AD7-2447-0000-A00000000003}) (Version: 10.0.0 - Adobe Systems Incorporated)
Communication Assistant (HKLM\...\{CEC89070-64E7-48E7-94C6-3468650105FE}) (Version: 3.0.32.0 - Panasonic)
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{81FB7C60-565A-4869-9D90-3BE1D270E8B7}) (Version: - Microsoft)
DWG TrueView 2011 (HKLM\...\DWG TrueView 2011) (Version: 18.1.49.0 - Autodesk)
DWG TrueView 2011 (Version: 18.1.49.0 - Autodesk) Hidden
Free Spider Solitaire 2010 v2.1 (HKLM\...\Free Spider_is1) (Version: - TreeCardGames.com)
FreePDF (Remove only) (HKLM\...\FreePDF_XP) (Version: - )
Google Chrome (HKLM\...\Google Chrome) (Version: 34.0.1847.116 - Google Inc.)
Google Chrome Frame (HKLM\...\{7455D86F-5295-389C-AA29-18D2BDAF8DD8}) (Version: 65.169.102 - Google, Inc.)
Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (Version: 1.3.23.9 - Google Inc.) Hidden
GPC.EU 2013 (HKLM\...\{911984E6-CFBF-43EF-9D86-6AC81E35856C}) (Version: 2013.01 - Güntner AG & Co. KG)
GPL Ghostscript (HKLM\...\GPL Ghostscript 9.04) (Version: 9.04 - Artifex Software Inc.)
Hotkey 3.3043 (HKLM\...\InstallShield_{164714B6-46BC-4649-9A30-A6ED32F03B5A}) (Version: 3.3043 - NoteBook)
Hotkey 3.3043 (Version: 3.3043 - NoteBook) Hidden
HP Deskjet 1050 J410 series - Grundlegende Software für das Gerät (HKLM\...\{9C31FFDC-E796-4884-B990-41B9A5B2A647}) (Version: 28.0.1313.0 - Hewlett-Packard Co.)
Infineon TPM Professional Package (HKLM\...\{D95BF23B-7E7D-4A72-801F-304C143778F7}) (Version: 3.7.000 - Infineon Technologies AG)
Intel(R) Control Center (HKLM\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (HKLM\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Network Connections 15.8.76.0 (HKLM\...\PROSetDX) (Version: 15.8.76.0 - Intel)
Intel(R) Network Connections 15.8.76.0 (Version: 15.8.76.0 - Intel) Hidden
Intel(R) Processor Graphics (HKLM\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2462 - Intel Corporation)
Internet Manager (HKLM\...\Internet Manager) (Version: 22.001.18.00.748 - Huawei Technologies Co.,Ltd)
Java 7 Update 51 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.510 - Oracle)
Java Auto Updater (Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
JMicron Flash Media Controller Driver (HKLM\...\{26604C7E-A313-4D12-867F-7C6E7820BE4C}) (Version: 1.0.62.0 - JMicron Technology Corp.)
Junk Mail filter update (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
LANCAPI (HKLM\...\LcsCapi) (Version: 8.0.4.0 - )
LANCAPI DFÜ-Netzwerk Unterstützung (HKLM\...\LcsNdisWan) (Version: - )
LiveReg (Symantec Corporation) (HKLM\...\LiveReg) (Version: 2.0.6.1314 - Symantec Corporation)
LiveUpdate 1.6 (Symantec Corporation) (HKLM\...\LiveUpdate1.6) (Version: - Symantec Corporation)
Malwarebytes Anti-Malware Version 2.0.1.1004 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation)
Mesh Runtime (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Messenger Companion (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Antimalware Service DE-DE Language Pack (Version: 2.1.6805.0 - Microsoft Corporation) Hidden
Microsoft Antimalware Service DE-DE Language Pack (Version: 3.0.8107.0 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook Connector (HKLM\...\{95140000-007A-0407-0000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Outlook Social Connector Provider for Windows Live Messenger 32-bit (HKLM\...\{95140000-007D-0409-0000-0000000FF1CE}) (Version: 14.0.5120.5000 - Microsoft Corporation)
Microsoft Security Client (Version: 4.0.1526.0 - Microsoft Corporation) Hidden
Microsoft Security Client DE-DE Language Pack (Version: 2.0.0657.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.0.1526.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Mozilla Firefox 28.0 (x86 de) (HKLM\...\Mozilla Firefox 28.0 (x86 de)) (Version: 28.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla)
MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden
MT Systemprotokoll - 1 (HKCU\...\c70d8575b852c7df) (Version: 1.0.14.42 - MT-Energie)
MT-Anlageneinwahl (HKCU\...\36f5116446c0416f) (Version: 2.0.0.122 - MT-Energie)
MTDataBrowserConfig (HKCU\...\4a3804723ba2dd23) (Version: 1.0.0.151 - MT-Energie)
MT-Leitwarte - 1 (HKCU\...\eacb0b902b4e2fa3) (Version: 1.0.0.224 - MT-Energie)
MyTomTom 3.2.0.1116 (HKLM\...\MyTomTom) (Version: 3.2.0.1116 - TomTom)
Protector Suite 2011 (HKLM\...\{FF960845-F006-40B0-B3B3-697219EF78B2}) (Version: 5.9.5.7004 - Authentec Inc.)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6449 - Realtek Semiconductor Corp.)
RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version: - )
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (Version: - Microsoft) Hidden
Shrew Soft VPN Client (HKLM\...\Shrew Soft VPN Client) (Version: - )
Skype™ 6.11 (HKLM\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
SolSuite 2014 v14.0 (HKLM\...\SolSuite_is1) (Version: 14.0 - TreeCardGames)
Sweet Home 3D version 3.6 (HKLM\...\Sweet Home 3D_is1) (Version: - eTeks)
Symantec pcAnywhere (HKLM\...\{D05E8183-866A-11D3-97DF-0000F8D8F2E9}) (Version: 10.5.1 - Symantec)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.1.14.0 - Synaptics Incorporated)
TI USB 3.0 Host Controller Driver (HKLM\...\InstallShield_{EB3C6814-1327-4B63-85CB-8A69AF09BAA6}) (Version: 1.12.7.0 - Ihr Firmenname)
TI USB3 Host Driver (Version: 1.12.7.0 - Ihr Firmenname) Hidden
TROX Easy Product Finder (HKLM\...\{9A0BA16B-6947-45D4-B796-0EB9C86AA226}) (Version: 1.7.4394 - TROX GmbH)
UltraVnc (HKLM\...\Ultravnc2_is1) (Version: 1.0.9.6.1 - uvnc bvba)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{001E8BF3-EDC3-4D5E-9C11-1D0E599B6497}) (Version: - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version: - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817396) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{39767ECA-1731-45DB-AB5B-6BF40E151D66}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{35698CB7-AAA2-4577-B505-DBFF504AEF23}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{BA610006-2C39-4419-9834-CF61AB24810A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2837583) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{E21274CE-CA0C-49FA-93F4-DC292A052264}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUS_{C70D2038-A2C4-4A99-87DE-5272BB44F0CE}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM\...\{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUS_{B5C70C99-B109-42FD-B219-FF12CA543F19}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUS_{82F87E28-B18E-46D6-A399-E2F19CF5949B}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM\...\{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUS_{A0657506-69DC-44AE-8DC1-58E7C6F5B1C9}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (HKLM\...\{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUS_{81812245-FC84-426A-BC02-6659C88CC7B2}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2775360) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{80F56E3F-1D47-4E45-B6E0-FEF4E919F4F9}) (Version: - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version: - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{8C55AA83-54C2-4236-A622-78440A411DC5}) (Version: - Microsoft)
Visual Studio C++ 10.0 Runtime (HKLM\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)
VLC media player 2.0.8 (HKLM\...\VLC media player) (Version: 2.0.8 - VideoLAN)
WebCam Installer (HKLM\...\InstallShield_{2A14D7BC-1876-4B38-830B-18856C27F550}) (Version: 4.00 - WebCam)
WebCam Installer (Version: 4.00 - WebCam) Hidden
Wilo-Select (HKLM\...\Wilo-Select 3.1) (Version: 0.0.0 - WILO SE)
Windows Live Communications Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Live Essentials (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 15.4.3555.0308 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
Windows Live Installer (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mail (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX control for remote connections (HKLM\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Messenger Companion Core (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows-Treiberpaket - Intel (NETwLv32) net (10/07/2010 13.4.0.139) (HKLM\...\695CFD288064D5B9D072C610E63BDD3D3E4DE666) (Version: 10/07/2010 13.4.0.139 - Intel)
Windows-Treiberpaket - Intel (NETwNs32) net (10/27/2011 14.3.0.6) (HKLM\...\CE28819521C39EEEB505E56D3AF26CDF72178397) (Version: 10/27/2011 14.3.0.6 - Intel)
==================== Restore Points =========================
30-08-2012 06:33:59 Windows Update
==================== Hosts content: ==========================
2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {5B21EC54-CCC2-40D5-8FE7-74764F4F35A9} - System32\Tasks\Fifth => C:\Users\petb\AppData\Roaming\Fifth\Fifth.exe [2014-03-12] () <==== ATTENTION
Task: {6A73504E-96F9-4247-A15F-570575C9EF7E} - System32\Tasks\{57DD11A1-A789-48E7-99D8-85DFE3940C7E} => Firefox.exe hxxp://ui.skype.com/ui/0/6.3.0.107/de/abandoninstall?source=lightinstaller&page=tsPlugin
Task: {90ED186B-2F8D-4319-BA3D-A35A3B80E0EB} - System32\Tasks\OMESupervisor => C:\Users\petb\AppData\Local\omesuperv.exe <==== ATTENTION
Task: {B4A63E74-417D-4613-98CC-E7B0B308CF25} - System32\Tasks\{F355047F-C6B6-41D1-A0CE-11ADFBFA53DC} => Firefox.exe hxxp://ui.skype.com/ui/0/6.1.0.129.272/de/abandoninstall?page=tsProgressBar
==================== Loaded Modules (whitelisted) =============
2012-08-30 09:01 - 2010-06-17 21:56 - 00116224 _____ () C:\Windows\System32\redmonnt.dll
2011-01-28 06:03 - 2011-01-28 06:03 - 00270176 _____ () C:\ProgramData\DatacardService\HWDeviceService.exe
2013-07-01 10:21 - 2013-07-01 10:21 - 00772408 _____ () C:\Program Files\ShrewSoft\VPN Client\iked.exe
2013-07-01 01:16 - 2013-07-01 01:16 - 00438272 _____ () C:\Program Files\ShrewSoft\VPN Client\libike.dll
2013-07-01 01:15 - 2013-07-01 01:15 - 00016384 _____ () C:\Program Files\ShrewSoft\VPN Client\libidb.dll
2013-07-01 01:15 - 2013-07-01 01:15 - 00014848 _____ () C:\Program Files\ShrewSoft\VPN Client\libith.dll
2013-07-01 01:17 - 2013-07-01 01:17 - 00030208 _____ () C:\Program Files\ShrewSoft\VPN Client\libvnet.dll
2013-07-01 01:16 - 2013-07-01 01:16 - 00010752 _____ () C:\Program Files\ShrewSoft\VPN Client\liblog.dll
2013-07-01 01:16 - 2013-07-01 01:16 - 00102400 _____ () C:\Program Files\ShrewSoft\VPN Client\libip.dll
2013-07-01 01:17 - 2013-07-01 01:17 - 00024576 _____ () C:\Program Files\ShrewSoft\VPN Client\libpfk.dll
2013-07-01 01:17 - 2013-07-01 01:17 - 00014848 _____ () C:\Program Files\ShrewSoft\VPN Client\libdtp.dll
2013-07-01 01:17 - 2013-07-01 01:17 - 00026624 _____ () C:\Program Files\ShrewSoft\VPN Client\libvflt.dll
2012-10-26 16:21 - 2012-10-26 16:19 - 00224096 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\ouc.exe
2012-10-26 16:21 - 2012-10-26 16:19 - 00011362 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\mingwm10.dll
2012-10-26 16:21 - 2012-10-26 16:19 - 00043008 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\libgcc_s_dw2-1.dll
2012-10-26 16:21 - 2012-10-26 16:19 - 02415104 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\QtCore4.dll
2012-10-26 16:21 - 2012-10-26 16:19 - 01148416 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\QtNetwork4.dll
2013-07-01 10:21 - 2013-07-01 10:21 - 00544400 _____ () C:\Program Files\ShrewSoft\VPN Client\ipsecd.exe
2011-02-15 17:16 - 2011-02-15 17:16 - 00033792 _____ () C:\Program Files\Hotkey\PowerBiosServer.exe
2013-09-05 01:14 - 2013-09-05 01:14 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2012-08-18 10:45 - 2011-07-26 09:37 - 00094208 _____ () C:\Windows\System32\IccLibDll.dll
2013-05-23 13:53 - 2013-05-23 13:53 - 00026040 _____ () C:\Program Files\MyTomTom 3\DeviceDetection.dll
2013-05-23 13:53 - 2013-05-23 13:53 - 00074680 _____ () C:\Program Files\MyTomTom 3\TomTomSupporterBase.dll
2013-05-23 13:53 - 2013-05-23 13:53 - 00279480 _____ () C:\Program Files\MyTomTom 3\TomTomSupporterProxy.dll
2011-08-25 15:00 - 2011-08-25 15:00 - 03080192 _____ () C:\Program Files\Hotkey\Hotkey.exe
2009-06-06 14:50 - 2009-06-06 14:50 - 00019968 _____ () C:\Program Files\Hotkey\Audiodll.dll
2014-03-18 21:19 - 2014-03-18 21:19 - 03642480 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2014-03-18 07:31 - 2014-03-18 07:31 - 16276872 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_77.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\Users\petb\Desktop\removeMSLicensing.reg:tbfinfo
==================== Safe Mode (whitelisted) ===================
==================== Disabled items from MSCONFIG ==============
MSCONFIG\Services: Skype C2C Service => 2
==================== Faulty Device Manager Devices =============
Name: Shrew Soft Virtual Adapter #2
Description: Shrew Soft Virtual Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Shrew Soft
Service: vnet
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Shrew Soft Virtual Adapter
Description: Shrew Soft Virtual Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Shrew Soft
Service: vnet
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (04/10/2014 07:33:14 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/10/2014 08:46:52 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (04/10/2014 06:50:20 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/09/2014 08:43:54 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/09/2014 08:25:14 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/09/2014 08:10:50 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/09/2014 07:18:10 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/09/2014 06:13:05 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/09/2014 10:49:44 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (04/09/2014 06:45:12 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (04/10/2014 07:31:56 PM) (Source: Microsoft-Windows-GroupPolicy) (User: MT-ENERGIE)
Description: Bei der Verarbeitung der Gruppenrichtlinie ist aufgrund fehlender Netzwerkkonnektivität mit einem Domänencontroller ein Fehler aufgetreten. Dies kann eine vorübergehende Bedingung sein. Es wird eine Erfolgsmeldung generiert, wenn die Verbindung des Computers mit dem Domänencontroller wiederhergestellt wurde und wenn die Gruppenrichtlinie erfolgreich verarbeitet wurde. Falls für mehrere Stunden keine Erfolgsmeldung angezeigt wird, wenden Sie sich an den Administrator.
Error: (04/10/2014 07:31:39 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Internet Manager. OUC" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (04/10/2014 07:31:39 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Internet Manager. OUC erreicht.
Error: (04/10/2014 07:31:35 PM) (Source: Microsoft-Windows-GroupPolicy) (User: NT-AUTORITÄT)
Description: Bei der Verarbeitung der Gruppenrichtlinie ist aufgrund fehlender Netzwerkkonnektivität mit einem Domänencontroller ein Fehler aufgetreten. Dies kann eine vorübergehende Bedingung sein. Es wird eine Erfolgsmeldung generiert, wenn die Verbindung des Computers mit dem Domänencontroller wiederhergestellt wurde und wenn die Gruppenrichtlinie erfolgreich verarbeitet wurde. Falls für mehrere Stunden keine Erfolgsmeldung angezeigt wird, wenden Sie sich an den Administrator.
Error: (04/10/2014 07:31:33 PM) (Source: NETLOGON) (User: )
Description: Der Computer konnte eine sichere Sitzung mit einem
Domänencontroller in der Domäne MT-ENERGIE aufgrund der folgenden
Ursache nicht einrichten:
%%1311
Dies kann zu Authentifizierungsproblemen führen. Stellen
Sie sicher, dass der Computer mit dem Netzwerk verbunden ist.
Wenden Sie sich an den Domänenadministrator, wenn das Problem
weiterhin besteht.
ZUSÄTZLICHE INFORMATIONEN
Wenn dieser Computer ein Domänencontroller der bestimmten
Domäne ist, wird eine sichere Sitzung zum primären
Domänencontrolleremulator in der bestimmten Domäne eingerichtet.
Andernfalls richtet dieser Computer eine sichere Sitzung zu
einem beliebigen Domänencontroller in der bestimmten Domäne ein.
Error: (04/10/2014 06:48:45 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Internet Manager. OUC" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (04/10/2014 06:48:45 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Internet Manager. OUC erreicht.
Error: (04/09/2014 08:42:30 PM) (Source: Microsoft-Windows-GroupPolicy) (User: MT-ENERGIE)
Description: Bei der Verarbeitung der Gruppenrichtlinie ist aufgrund fehlender Netzwerkkonnektivität mit einem Domänencontroller ein Fehler aufgetreten. Dies kann eine vorübergehende Bedingung sein. Es wird eine Erfolgsmeldung generiert, wenn die Verbindung des Computers mit dem Domänencontroller wiederhergestellt wurde und wenn die Gruppenrichtlinie erfolgreich verarbeitet wurde. Falls für mehrere Stunden keine Erfolgsmeldung angezeigt wird, wenden Sie sich an den Administrator.
Error: (04/09/2014 08:42:16 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Internet Manager. OUC" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (04/09/2014 08:42:16 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Internet Manager. OUC erreicht.
Microsoft Office Sessions:
=========================
Error: (04/10/2014 07:33:14 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/10/2014 08:46:52 AM) (Source: SideBySide)(User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"C:\Program Files\HP\HP Deskjet 1050 J410 series\DriverStore\Pipeline\amd64\hpinkins8911.exe
Error: (04/10/2014 06:50:20 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/09/2014 08:43:54 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/09/2014 08:25:14 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/09/2014 08:10:50 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/09/2014 07:18:10 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/09/2014 06:13:05 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/09/2014 10:49:44 AM) (Source: SideBySide)(User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"C:\Program Files\HP\HP Deskjet 1050 J410 series\DriverStore\Pipeline\amd64\hpinkins8911.exe
Error: (04/09/2014 06:45:12 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
==================== Memory info ===========================
Percentage of memory in use: 46%
Total physical RAM: 3492.24 MB
Available physical RAM: 1878.97 MB
Total Pagefile: 6982.77 MB
Available Pagefile: 5219.56 MB
Total Virtual: 2047.88 MB
Available Virtual: 1883.12 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:465.76 GB) (Free:411.39 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 57F4DA4C)
Partition 1: (Active) - (Size=466 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Zitat:
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 13-03-2014 01 (ATTENTION: ====> FRST version is 28 days old and could be outdated) Ran by petb (administrator) on NBPETERBOSSE on 10-04-2014 19:38:33 Running from C:\Users\petb\Downloads Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: German Standard Internet Explorer Version 10 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: Downloading Farbar Recovery Scan Tool Download link for 64-Bit Version: Downloading Farbar Recovery Scan Tool Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials ==================== Processes (Whitelisted) ================= (Microsoft Corporation) c:\Program Files\Microsoft Security Client\MsMpEng.exe () C:\ProgramData\DatacardService\HWDeviceService.exe (Authentec Inc.) C:\Program Files\Protector Suite 2011\upeksvr.exe (Infineon Technologies AG) C:\Program Files\Infineon\Security Platform Software\ifxspmgt.exe (Infineon Technologies AG) C:\Program Files\Infineon\Security Platform Software\ifxtcs.exe () C:\Program Files\ShrewSoft\VPN Client\iked.exe (Intel Corporation) C:\Windows\system32\IProsetMonitor.exe () C:\ProgramData\Internet Manager\OnlineUpdate\ouc.exe () C:\Program Files\ShrewSoft\VPN Client\ipsecd.exe (LANCOM Systems GmbH, Würselen (Germany)) C:\Program Files\LANCOM\LANCAPI\fwtool.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe (Infineon Technologies AG) C:\Program Files\Infineon\Security Platform Software\IfxPsdSv.exe () C:\Program Files\Hotkey\PowerBiosServer.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Chicony) C:\Program Files\ChiconyCam\CECAPLF.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Authentec Inc.) C:\Program Files\Protector Suite 2011\psqltray.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (shbox.de) C:\Program Files\FreePDF_XP\fpassist.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe (Infineon Technologies AG) C:\Program Files\Infineon\Security Platform Software\PSDrt.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (TomTom) C:\Program Files\MyTomTom 3\MyTomTomSA.exe (Infineon Technologies AG) C:\Program Files\Infineon\Security Platform Software\SpTna.exe (Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe () C:\Program Files\Hotkey\Hotkey.exe (LANCOM Systems GmbH, Würselen (Germany)) C:\Program Files\LANCOM\LANCAPI\rcapi.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe (Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1897768 2010-09-17] (Synaptics Incorporated) HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10828392 2011-08-26] (Realtek Semiconductor) HKLM\...\Run: [CECAPLF] - C:\Program Files\ChiconyCam\CECAPLF.exe [121456 2010-09-17] (Chicony) HKLM\...\Run: [PSQLLauncher] - c:\Program Files\Protector Suite 2011\launcher.exe [55624 2011-04-07] (Authentec Inc.) HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM\...\Run: [IFXSPMGT] - C:\Program Files\Infineon\Security Platform Software\ifxspmgt.exe [1160480 2010-02-24] (Infineon Technologies AG) HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation) HKLM\...\Run: [FreePDF Assistant] - C:\Program Files\FreePDF_XP\fpassist.exe [371200 2011-02-23] (shbox.de) HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [931200 2012-03-26] (Microsoft Corporation) HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) Winlogon\Notify\PCANotify: C:\Windows\system32\PCANotify.dll (Symantec Corporation) Winlogon\Notify\psfus: c:\Program Files\Protector Suite 2011\psqlpwd.dll (Authentec Inc.) HKU\S-1-5-21-1490601572-125806904-1540184845-1330\...\Run: [MyTomTomSA.exe] - C:\Program Files\MyTomTom 3\MyTomTomSA.exe [455608 2013-05-23] (TomTom) HKU\S-1-5-21-1490601572-125806904-1540184845-1330\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.) HKU\S-1-5-21-1490601572-125806904-1540184845-1330\...\MountPoints2: {16d34b6f-1f5a-11e2-94e5-00a05707c5c0} - E:\AutoRun.exe HKU\S-1-5-21-1490601572-125806904-1540184845-1330\...\MountPoints2: {2b37c07f-2fbb-11e2-97b1-00a05707c5c0} - E:\AutoRun.exe HKU\S-1-5-21-1490601572-125806904-1540184845-1330\...\MountPoints2: {dd5c0076-299b-11e2-93e2-00a05707c5c0} - E:\AutoRun.exe HKU\S-1-5-21-1490601572-125806904-1540184845-1330\...\MountPoints2: {e5627c2c-1f69-11e2-94d9-00a05707c5c0} - E:\AutoRun.exe Lsa: [Notification Packages] scecli c:\Program Files\Protector Suite 2011\psqlpwd.dll Startup: C:\Users\petb\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LANCAPI.lnk ShortcutTarget: LANCAPI.lnk -> C:\Program Files\LANCOM\LANCAPI\rcapi.exe (LANCOM Systems GmbH, Würselen (Germany)) Startup: C:\Users\petb\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Deskjet 1050 J410 series.lnk ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://native-search.com/?channel=deg HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN Deutschland: Aktuelle Nachrichten, Outlook.com Email und Skype Login. SearchScopes: HKLM - DefaultScope value is missing. SearchScopes: HKLM - {9039DE6E-6967-465C-95B1-261BD3098D2A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE9TR&src=IE9TR&pc=MASBJS SearchScopes: HKCU - {9039DE6E-6967-465C-95B1-261BD3098D2A} URL = SearchScopes: HKCU - {906114F6-8D76-41F4-AAB4-9738403D3C54} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=OSJ000YYDE&apn_uid=B0494CAD-CF97-4324-9A0D-D48FA56CC28F&apn_sauid=D4D8A3E3-FCF6-4F4B-8986-0406EDCBD6EA SearchScopes: HKCU - {9F55257F-5F9C-470A-A486-217A9184787B} URL = hxxp://search.softonic.com/MOY00621/tb_v1?q={searchTerms}&SearchSource=4&cc=&mi=3298b3760000000000004c80936502f8&r=805 BHO: Simple New Tab Bho - {5C2DD58F-613F-4580-8AC0-F10D760AF938} - C:\Users\petb\AppData\Local\simple_new_tab\simple_new_tab.dll (Temp Company Ltd) BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO: ChromeFrame BHO - {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} - C:\Program Files\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.) Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab Handler: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - C:\Program Files\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.) Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 Tcpip\..\Interfaces\{17A15FAB-52D6-41F9-BE5F-53C18E6EE879}: [NameServer]10.74.210.210 10.74.210.211 Tcpip\..\Interfaces\{2A56C192-890D-4AF3-9301-C2BB2E136FE0}: [NameServer]10.74.210.210 10.74.210.211 Tcpip\..\Interfaces\{357CBB3B-1DF5-407A-BF5B-A38F440E7F8E}: [NameServer]10.0.0.1 Tcpip\..\Interfaces\{623CA0FD-767F-4F4B-ABC5-17AD05AE9E67}: [NameServer]10.0.0.1 Tcpip\..\Interfaces\{D9569A4C-10D1-42E4-B42C-0E1772AE83B2}: [NameServer]10.74.210.210 10.74.210.211 FireFox: ======== FF ProfilePath: C:\Users\petb\AppData\Roaming\Mozilla\Firefox\Profiles\kh0qzimo.default FF DefaultSearchEngine: Search FF SelectedSearchEngine: Search FF Homepage: https://www.google.de FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_77.dll () FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @videolan.org/vlc,version=2.0.8 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: bebomedia.com/OfferMosquitoIEHelper - C:\Users\petb\AppData\Local\ext_offermosquito\npOfferMosquitoIEHelper.dll No File FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Simple New Tab - C:\Users\petb\AppData\Roaming\Mozilla\Firefox\Profiles\kh0qzimo.default\Extensions\snt@dotlabs.co.xpi [2013-11-13] FF HKLM\...\Firefox\Extensions: [ff-bmboc@bytemobile.com] - C:\Program Files\T-Mobile\InternetManager_H\OCx32\addon FF Extension: Bytemobile Optimization Client - C:\Program Files\T-Mobile\InternetManager_H\OCx32\addon [2012-10-26] Chrome: ======= CHR HomePage: http:\/\/native-search.com\/?channel=deg CHR RestoreOnStartup: "http:\/\/native-search.com\/?channel=deg" ], "restore_on_startup_migrated": true, "restore_on_startup" CHR DefaultSearchKeyword: Search CHR DefaultSearchProvider: Search CHR DefaultSearchURL: http:\/\/native-search.com\/search.php?channel=deg&q={searchTerms} CHR Extension: (Google Drive) - C:\Users\petb\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2012-11-07] CHR Extension: (YouTube) - C:\Users\petb\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-11-07] CHR Extension: (Google Search) - C:\Users\petb\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-11-07] CHR Extension: (OfferMosquito) - C:\Users\petb\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbmdkmlcnbapgegninelmjbfibaghdmk [2014-02-17] CHR Extension: (Gmail) - C:\Users\petb\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-11-07] CHR Extension: (Simple New Tab) - C:\Users\petb\AppData\Local\Google\Chrome\User Data\Default\Extensions\pmgkeimkiojpjcoiiipekfjaopchhjga [2014-03-24] ========================== Services (Whitelisted) ================= S3 awhost32; C:\Program Files\Symantec\pcAnywhere\awhost32.exe [114749 2002-02-15] (Symantec Corporation) R2 HWDeviceService.exe; C:\ProgramData\DatacardService\HWDeviceService.exe [270176 2011-01-28] () R2 IFXSpMgtSrv; C:\Program Files\Infineon\Security Platform Software\ifxspmgt.exe [1160480 2010-02-24] (Infineon Technologies AG) R2 IFXTCS; C:\Program Files\Infineon\Security Platform Software\ifxtcs.exe [992544 2010-02-24] (Infineon Technologies AG) R2 iked; C:\Program Files\ShrewSoft\VPN Client\iked.exe [772408 2013-07-01] () R2 Intel(R) PROSet Monitoring Service; C:\Windows\system32\IProsetMonitor.exe [110240 2010-10-25] (Intel Corporation) S2 Internet Manager. RunOuc; C:\Program Files\T-Mobile\InternetManager_H\UpdateDog\ouc.exe [224096 2012-10-26] () R2 ipsecd; C:\Program Files\ShrewSoft\VPN Client\ipsecd.exe [544400 2013-07-01] () R2 LcsFwTool; C:\Program Files\LANCOM\LANCAPI\fwtool.exe [199680 2011-06-16] (LANCOM Systems GmbH, Würselen (Germany)) R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation) R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [11552 2012-03-26] (Microsoft Corporation) S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [214952 2012-03-26] (Microsoft Corporation) R2 PersonalSecureDriveService; C:\Program Files\Infineon\Security Platform Software\IfxPsdSv.exe [214304 2010-02-24] (Infineon Technologies AG) R2 PowerBiosServer; C:\Program Files\Hotkey\PowerBiosServer.exe [33792 2011-02-15] () ==================== Drivers (Whitelisted) ==================== R1 awlegacy; C:\Windows\System32\Drivers\awlegacy.sys [10816 2000-09-11] (Symantec Corporation) S4 AW_HOST; C:\Windows\System32\drivers\aw_host5.sys [33496 2002-02-11] (Symantec Corporation) R3 e1cexpress; C:\Windows\System32\DRIVERS\e1c6232.sys [238760 2010-10-28] (Intel Corporation) R0 Gernuwa; C:\Windows\system32\Drivers\Gernuwa.sys [14944 2001-10-09] (Symantec Corporation) S3 huawei_cdcacm; C:\Windows\System32\DRIVERS\ew_jucdcacm.sys [90112 2012-10-26] (Huawei Technologies Co., Ltd.) S3 huawei_ext_ctrl; C:\Windows\System32\DRIVERS\ew_juextctrl.sys [26624 2012-10-26] (Huawei Technologies Co., Ltd.) S3 huawei_wwanecm; C:\Windows\System32\DRIVERS\ew_juwwanecm.sys [181760 2012-10-26] (Huawei Technologies Co., Ltd.) S3 IAMT03; C:\Windows\system32\drivers\IAMT03.sys [40848 2007-04-12] (Intel Corporation) S3 IAMTV; C:\Windows\system32\drivers\IAMTV.sys [38288 2007-04-12] (Intel Corporation) S3 IAMTXP; C:\Windows\system32\drivers\IAMTXP.sys [47496 2007-04-12] (Intel Corporation) R3 LcsCapiDrv; C:\Windows\System32\DRIVERS\rcapi.sys [246784 2011-06-16] (LANCOM Systems) R3 LCSWAN; C:\Windows\System32\DRIVERS\LCSWAN.sys [25600 2010-11-04] (LANCOM Systems) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-04-03] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [107736 2014-04-10] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51416 2014-04-03] (Malwarebytes Corporation) R3 MEI; C:\Windows\system32\drivers\HECI.sys [41088 2010-10-20] (Intel Corporation) R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [171064 2012-03-20] (Microsoft Corporation) R3 NETwNs32; C:\Windows\System32\DRIVERS\NETwNs32.sys [7522304 2011-10-31] (Intel Corporation) R1 PersonalSecureDrive; C:\Windows\System32\drivers\psd.sys [39712 2010-01-26] (Infineon Technologies AG) S3 Ser2plx86; C:\Windows\System32\DRIVERS\ser2pl.sys [139776 2013-10-25] (Prolific Technology Inc.) S3 SymEvent; C:\Program Files\Symantec\SYMEVENT.SYS [57968 2012-09-03] (Symantec Corporation) R3 tihub3; C:\Windows\system32\drivers\tihub3.sys [104520 2011-06-02] (Texas Instruments Incorporated) R3 tixhci; C:\Windows\system32\drivers\tixhci.sys [319560 2011-06-02] (Texas Instruments Incorporated) R1 vflt; C:\Windows\System32\DRIVERS\vfilter.sys [18944 2013-07-01] (Shrew Soft Inc) S3 vnet; C:\Windows\System32\DRIVERS\virtualnet.sys [13824 2010-09-02] (Shrew Soft Inc) R3 vpcbus; C:\Windows\system32\drivers\vpchbus.sys [165376 2009-09-23] (Microsoft Corporation) R1 vpcnfltr; C:\Windows\System32\DRIVERS\vpcnfltr.sys [55040 2009-09-23] (Microsoft Corporation) R3 vpcusb; C:\Windows\System32\DRIVERS\vpcusb.sys [78336 2009-09-23] (Microsoft Corporation) R1 vpcvmm; C:\Windows\System32\drivers\vpcvmm.sys [295936 2009-12-31] (Microsoft Corporation) S3 cpuz135; \??\C:\Users\ADMINI~1\AppData\Local\Temp\cpuz135\cpuz135_x32.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-04-10 19:38 - 2014-04-10 19:38 - 00018801 _____ () C:\Users\petb\Downloads\FRST.txt 2014-04-10 19:38 - 2014-04-10 19:38 - 00000000 ____D () C:\FRST 2014-04-10 07:25 - 2014-04-10 07:25 - 01145856 _____ (Farbar) C:\Users\petb\Downloads\FRST.exe 2014-04-10 06:51 - 2014-04-10 06:52 - 01070840 _____ (Solid State Networks) C:\Users\petb\Downloads\install_flashplayer13x32au_mssa_aaa_aih.exe 2014-04-09 20:39 - 2014-04-09 20:39 - 00000924 _____ () C:\Users\petb\Desktop\checkup.txt 2014-04-09 20:38 - 2014-04-09 20:38 - 00987448 _____ () C:\Users\petb\Downloads\SecurityCheck.exe 2014-04-09 20:27 - 2014-04-09 20:27 - 00012244 _____ () C:\Users\petb\Desktop\AdwCleaner[S0].txt 2014-04-09 20:19 - 2014-04-09 20:22 - 00000000 ____D () C:\AdwCleaner 2014-04-09 20:18 - 2014-04-09 20:18 - 01426178 _____ () C:\Users\petb\Downloads\adwcleaner.exe 2014-04-09 19:28 - 2014-04-09 19:28 - 00013484 _____ () C:\Users\petb\Desktop\bedrohung.txt 2014-04-09 18:56 - 2014-04-10 19:32 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-04-09 18:55 - 2014-04-09 18:55 - 00001020 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-04-09 18:55 - 2014-04-09 18:55 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-04-09 18:55 - 2014-04-09 18:55 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-04-09 18:55 - 2014-04-03 09:51 - 00073432 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-04-09 18:55 - 2014-04-03 09:51 - 00051416 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-04-09 18:55 - 2014-04-03 09:50 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-04-09 18:52 - 2014-04-09 18:53 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\petb\Downloads\mbam-setup-2.0.1.1004.exe 2014-04-07 15:20 - 2014-04-07 15:20 - 00010750 _____ () C:\Users\petb\Desktop\AB.xlsx 2014-04-02 10:33 - 2014-04-02 10:33 - 00000000 ____D () C:\Users\petb\AppData\Local\{C547F0FB-9F6B-4EB6-9D41-2D190338F9B3} 2014-04-01 08:53 - 2014-04-02 19:33 - 00011753 _____ () C:\Users\petb\Desktop\BHKW Zuordnung 042014.xlsx 2014-04-01 07:51 - 2014-04-01 16:51 - 00011125 _____ () C:\Users\petb\Desktop\BHKW Zuordnung.xlsx 2014-03-27 08:11 - 2014-03-27 17:27 - 00000000 ____D () C:\Users\petb\Desktop\Russland 2014-03-24 12:58 - 2014-03-24 12:57 - 00001917 _____ () C:\Users\petb\Desktop\AB Energy Preisliste 2013 clama v4 - Verknüpfung.lnk 2014-03-24 08:05 - 2014-03-24 08:05 - 00000000 ____D () C:\Users\petb\AppData\Local\simple_new_tab 2014-03-19 09:22 - 2014-03-19 09:22 - 00010974 _____ () C:\Users\petb\Documents\Lieferumfang.xlsx 2014-03-18 21:19 - 2014-03-18 21:19 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-03-18 17:44 - 2014-03-18 17:44 - 00001643 _____ () C:\Users\petb\Desktop\Clark.csv ==================== One Month Modified Files and Folders ======= 2014-04-10 19:38 - 2014-04-10 19:38 - 00018801 _____ () C:\Users\petb\Downloads\FRST.txt 2014-04-10 19:38 - 2014-04-10 19:38 - 00000000 ____D () C:\FRST 2014-04-10 19:36 - 2012-08-20 07:18 - 01285355 _____ () C:\Windows\WindowsUpdate.log 2014-04-10 19:34 - 2012-09-20 08:57 - 00000000 ____D () C:\Users\petb\AppData\Roaming\Skype 2014-04-10 19:32 - 2014-04-09 18:56 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-04-10 19:31 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-04-10 19:31 - 2009-07-14 06:39 - 00088366 _____ () C:\Windows\setupact.log 2014-04-10 17:15 - 2012-08-30 08:37 - 00000136 _____ () C:\Windows\system32\config\netlogon.ftl 2014-04-10 16:50 - 2012-09-10 10:34 - 00000000 ____D () C:\Users\petb\AppData\Local\Deployment 2014-04-10 09:55 - 2010-11-20 23:01 - 01627140 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-04-10 07:29 - 2009-07-14 06:34 - 00016768 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-04-10 07:29 - 2009-07-14 06:34 - 00016768 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-04-10 07:25 - 2014-04-10 07:25 - 01145856 _____ (Farbar) C:\Users\petb\Downloads\FRST.exe 2014-04-10 06:52 - 2014-04-10 06:51 - 01070840 _____ (Solid State Networks) C:\Users\petb\Downloads\install_flashplayer13x32au_mssa_aaa_aih.exe 2014-04-09 20:39 - 2014-04-09 20:39 - 00000924 _____ () C:\Users\petb\Desktop\checkup.txt 2014-04-09 20:38 - 2014-04-09 20:38 - 00987448 _____ () C:\Users\petb\Downloads\SecurityCheck.exe 2014-04-09 20:27 - 2014-04-09 20:27 - 00012244 _____ () C:\Users\petb\Desktop\AdwCleaner[S0].txt 2014-04-09 20:22 - 2014-04-09 20:19 - 00000000 ____D () C:\AdwCleaner 2014-04-09 20:22 - 2014-01-29 22:52 - 00000000 ____D () C:\Users\petb\AppData\Roaming\Common 2014-04-09 20:18 - 2014-04-09 20:18 - 01426178 _____ () C:\Users\petb\Downloads\adwcleaner.exe 2014-04-09 19:28 - 2014-04-09 19:28 - 00013484 _____ () C:\Users\petb\Desktop\bedrohung.txt 2014-04-09 19:16 - 2012-08-18 11:00 - 00000000 ____D () C:\Windows\ConfigSetRoot 2014-04-09 19:16 - 2010-11-20 23:48 - 00177574 _____ () C:\Windows\PFRO.log 2014-04-09 18:55 - 2014-04-09 18:55 - 00001020 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-04-09 18:55 - 2014-04-09 18:55 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-04-09 18:55 - 2014-04-09 18:55 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-04-09 18:53 - 2014-04-09 18:52 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\petb\Downloads\mbam-setup-2.0.1.1004.exe 2014-04-09 13:31 - 2012-10-31 11:51 - 00000000 ____D () C:\Users\petb\Desktop\Privat 2014-04-09 13:31 - 2012-08-30 09:07 - 00001497 _____ () C:\Users\Public\Desktop\Viewer.lnk 2014-04-07 15:20 - 2014-04-07 15:20 - 00010750 _____ () C:\Users\petb\Desktop\AB.xlsx 2014-04-03 09:51 - 2014-04-09 18:55 - 00073432 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-04-03 09:51 - 2014-04-09 18:55 - 00051416 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-04-03 09:50 - 2014-04-09 18:55 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-04-03 09:09 - 2013-01-09 21:16 - 00000000 ____D () C:\Users\petb\AppData\Local\Windows Live 2014-04-02 20:31 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\NDF 2014-04-02 19:33 - 2014-04-01 08:53 - 00011753 _____ () C:\Users\petb\Desktop\BHKW Zuordnung 042014.xlsx 2014-04-02 10:33 - 2014-04-02 10:33 - 00000000 ____D () C:\Users\petb\AppData\Local\{C547F0FB-9F6B-4EB6-9D41-2D190338F9B3} 2014-04-02 09:01 - 2014-03-04 16:56 - 00012539 _____ () C:\Users\petb\Desktop\Stunden Test.xlsx 2014-04-02 08:15 - 2014-01-29 13:10 - 00000000 ___SD () C:\Users\petb\Documents\SharePoint-Entwürfe 2014-04-01 16:51 - 2014-04-01 07:51 - 00011125 _____ () C:\Users\petb\Desktop\BHKW Zuordnung.xlsx 2014-03-30 19:51 - 2013-10-17 12:40 - 00000000 ____D () C:\Users\petb\Desktop\Stundenzettel 2014-03-27 17:27 - 2014-03-27 08:11 - 00000000 ____D () C:\Users\petb\Desktop\Russland 2014-03-27 07:30 - 2012-09-10 10:28 - 00077824 _____ () C:\Users\petb\Desktop\Berechung Rohrwiderstand Gas.xls 2014-03-24 12:57 - 2014-03-24 12:58 - 00001917 _____ () C:\Users\petb\Desktop\AB Energy Preisliste 2013 clama v4 - Verknüpfung.lnk 2014-03-24 08:06 - 2014-01-29 22:54 - 00000000 ____D () C:\Users\petb\AppData\Roaming\Fifth 2014-03-24 08:05 - 2014-03-24 08:05 - 00000000 ____D () C:\Users\petb\AppData\Local\simple_new_tab 2014-03-19 09:22 - 2014-03-19 09:22 - 00010974 _____ () C:\Users\petb\Documents\Lieferumfang.xlsx 2014-03-19 07:04 - 2013-01-29 15:14 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service 2014-03-18 21:19 - 2014-03-18 21:19 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-03-18 17:44 - 2014-03-18 17:44 - 00001643 _____ () C:\Users\petb\Desktop\Clark.csv 2014-03-18 07:31 - 2012-09-03 11:38 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2014-03-18 07:31 - 2012-09-03 11:38 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2014-03-13 08:14 - 2009-07-14 06:53 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-03-11 16:28 - 2014-02-12 07:20 - 00505087 _____ () C:\Users\petb\Desktop\Übergabe Claudia.xlsx Some content of TEMP: ==================== C:\Users\petb\AppData\Local\Temp\AcDeltree.exe C:\Users\petb\AppData\Local\Temp\APNStub.exe C:\Users\petb\AppData\Local\Temp\firefoxjre_exe.exe C:\Users\petb\AppData\Local\Temp\ICReinstall_ZipSetup.exe C:\Users\petb\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe C:\Users\petb\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe C:\Users\petb\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe C:\Users\petb\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe C:\Users\petb\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe C:\Users\petb\AppData\Local\Temp\Quarantine.exe C:\Users\petb\AppData\Local\Temp\SkypeSetup.exe C:\Users\petb\AppData\Local\Temp\uninst1.exe ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => MD5 is legit C:\Windows\system32\winlogon.exe => MD5 is legit C:\Windows\system32\wininit.exe => MD5 is legit C:\Windows\system32\svchost.exe => MD5 is legit C:\Windows\system32\services.exe => MD5 is legit C:\Windows\system32\User32.dll => MD5 is legit C:\Windows\system32\userinit.exe => MD5 is legit C:\Windows\system32\rpcss.dll => MD5 is legit C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-04-09 10:48 ==================== End Of Log ============================ --- --- --- --- --- --- |
|
11.04.2014, 07:35
| #4 |
| /// the machine /// TB-Ausbilder | http://search.fbdownloader.com/?channel=deg_nt Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
15.04.2014, 17:48
| #5 |
| | http://search.fbdownloader.com/?channel=deg_nt ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.1.3 (03.23.2014:1) OS: Windows 7 Professional x86 Ran by petb on 15.04.2014 at 18:42:26,46 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-1490601572-125806904-1540184845-1330\Software\sweetim Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{906114F6-8D76-41F4-AAB4-9738403D3C54} Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{9F55257F-5F9C-470A-A486-217A9184787B} ~~~ Files ~~~ Folders Successfully deleted: [Empty Folder] C:\Users\petb\appdata\local\{8947CF87-0F26-4939-9D1D-43C09809AE5D} Successfully deleted: [Empty Folder] C:\Users\petb\appdata\local\{A4A5F12C-4F7D-4769-A3FB-F58AB53A3806} Successfully deleted: [Empty Folder] C:\Users\petb\appdata\local\{B49496DF-9D35-405F-ACAE-F658F00DDEAA} Successfully deleted: [Empty Folder] C:\Users\petb\appdata\local\{C547F0FB-9F6B-4EB6-9D41-2D190338F9B3} Successfully deleted: [Empty Folder] C:\Users\petb\appdata\local\{CBFCA926-9A58-473A-9D13-FA2CD4B2A042} Successfully deleted: [Empty Folder] C:\Users\petb\appdata\local\{D13910C4-F460-4E9F-9D95-61C24147A38F} Successfully deleted: [Empty Folder] C:\Users\petb\appdata\local\{F36149B2-B920-4EA1-B93F-1BA275287DB6} ~~~ FireFox Successfully deleted the following from C:\Users\petb\AppData\Roaming\mozilla\firefox\profiles\kh0qzimo.default\prefs.js user_pref("simplenewtab.url", "hxxp://native-search.com/?channel=deg_nt"); Emptied folder: C:\Users\petb\AppData\Roaming\mozilla\firefox\profiles\kh0qzimo.default\minidumps [276 files] ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 15.04.2014 at 18:46:07,24 Computer was rebooted End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ |
|
16.04.2014, 18:50
| #6 |
| /// the machine /// TB-Ausbilder | http://search.fbdownloader.com/?channel=deg_nt und die andern Logs?
__________________ --> http://search.fbdownloader.com/?channel=deg_nt |
|
16.04.2014, 22:05
| #7 |
| | http://search.fbdownloader.com/?channel=deg_nt Hallo, die hatte ich doch schon vorher gemacht und oben am Anfang von meiner Frage eingefügt. Oder wie wo was? |
|
17.04.2014, 14:02
| #8 |
| /// the machine /// TB-Ausbilder | http://search.fbdownloader.com/?channel=deg_nt Ich habe dir 3 Programme aufgegeben, inklusive frischem FRST Scan, also 4 Logs, du postest nur 1 Log 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu http://search.fbdownloader.com/?channel=deg_nt |
| adwcleaner, anti-malware, besserung, channel, durchgeführt, fbdownloader.com/?channel=deg_nt, fenster, firefox, gen, installier, installiert, malwarebytes, malwarebytes anti-malware, neues, neues fenster, neustart, securitycheck, seite, suche |
Linear-Darstellung
